emotet | 9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197

General

Target

9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197.exe
Size

346KB
MD5

fd0e21bdbe19856ba45f049b2932d9f5
SHA1

10ecc2c74e1bfa53e5aeaf0e7363cd299b8e2263
SHA256

9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197
SHA512

aa45de56876e257ee36e3e3f5fd862756f5f334d9710fb5342057701211695562868c78408e1075976a887b40f74fd37733a6504f174a1855336ecbb1f506f2a
SSDEEP

6144:GYKfZo/eEoJ05TUdpMOUO7xWVoEf7liaUyzq0idLT3je/586763EApVAQHBuBNmd:GYKm/DoJ1MOUOEVoEf7oz53Tpn

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

74.208.74.92:8080

89.32.150.160:8080

80.240.141.141:7080

151.80.142.33:80

5.196.35.138:7080

200.58.171.51:80

81.213.215.216:50000

187.150.150.127:7080

149.62.173.247:8080

62.75.160.178:8080

170.84.133.72:8443

79.129.0.173:8080

181.29.101.13:8080

183.82.97.25:80

109.104.79.48:8080

201.199.93.30:443

159.203.204.126:8080

181.36.42.205:443

46.28.111.142:7080

178.249.187.151:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

shlpfwdr.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	shlpfwdr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

shlpfwdr.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F804C3-6D10-431D-B2B5-224412D7FA27}\WpadDecision = "0"	shlpfwdr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-d8-6c-5b-31-86	shlpfwdr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F804C3-6D10-431D-B2B5-224412D7FA27}\06-d8-6c-5b-31-86	shlpfwdr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-d8-6c-5b-31-86\WpadDecision = "0"	shlpfwdr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	shlpfwdr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	shlpfwdr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F804C3-6D10-431D-B2B5-224412D7FA27}\WpadDecisionTime = 5068de1c2e34d901	shlpfwdr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	shlpfwdr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	shlpfwdr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	shlpfwdr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	shlpfwdr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F804C3-6D10-431D-B2B5-224412D7FA27}\WpadNetworkName = "Network 2"	shlpfwdr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-d8-6c-5b-31-86\WpadDecisionTime = 5068de1c2e34d901	shlpfwdr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	shlpfwdr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	shlpfwdr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	shlpfwdr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F804C3-6D10-431D-B2B5-224412D7FA27}	shlpfwdr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F804C3-6D10-431D-B2B5-224412D7FA27}\WpadDecisionReason = "1"	shlpfwdr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-d8-6c-5b-31-86\WpadDecisionReason = "1"	shlpfwdr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	shlpfwdr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	shlpfwdr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

shlpfwdr.exe

pid process

2036 shlpfwdr.exe
2036 shlpfwdr.exe
2036 shlpfwdr.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197.exe

pid process

1640 9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197.exe

pid	process
2036	shlpfwdr.exe
2036	shlpfwdr.exe
2036	shlpfwdr.exe

pid	process
1640	9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197.exeshlpfwdr.exe

description	pid	process	target process
PID 1636 wrote to memory of 1640	1636	9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197.exe	9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197.exe
PID 1636 wrote to memory of 1640	1636	9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197.exe	9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197.exe
PID 1636 wrote to memory of 1640	1636	9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197.exe	9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197.exe
PID 1636 wrote to memory of 1640	1636	9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197.exe	9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197.exe
PID 1128 wrote to memory of 2036	1128	shlpfwdr.exe	shlpfwdr.exe
PID 1128 wrote to memory of 2036	1128	shlpfwdr.exe	shlpfwdr.exe
PID 1128 wrote to memory of 2036	1128	shlpfwdr.exe	shlpfwdr.exe
PID 1128 wrote to memory of 2036	1128	shlpfwdr.exe	shlpfwdr.exe

C:\Users\Admin\AppData\Local\Temp\9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197.exe
"C:\Users\Admin\AppData\Local\Temp\9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Users\Admin\AppData\Local\Temp\9f35e7c5a02f30bdde73e1ac97b9f45e755e722887d4f6f21737d3fc4309e197.exe
--7f45fff9
2⤵
- Suspicious behavior: RenamesItself
PID:1640

C:\Windows\SysWOW64\shlpfwdr.exe
"C:\Windows\SysWOW64\shlpfwdr.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\shlpfwdr.exe
--92e0486a
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2036

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-54-0x00000000002D0000-0x00000000002E7000-memory.dmp

Filesize
92KB

Download
memory/1640-59-0x0000000000000000-mapping.dmp

Download
memory/1640-60-0x0000000000340000-0x0000000000357000-memory.dmp

Filesize
92KB

Download
memory/1640-65-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/2036-71-0x0000000000000000-mapping.dmp

Download
memory/2036-72-0x00000000003C0000-0x00000000003D7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads